fix(security): 添加frameOptions配置以增强安全性
All checks were successful
test/timeline-server/pipeline/head This commit looks good
All checks were successful
test/timeline-server/pipeline/head This commit looks good
添加sameOrigin的frameOptions配置,防止点击劫持攻击
This commit is contained in:
@@ -14,6 +14,8 @@ public class SecurityConfig {
|
|||||||
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
|
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
|
||||||
http
|
http
|
||||||
.csrf(csrf -> csrf.disable())
|
.csrf(csrf -> csrf.disable())
|
||||||
|
.headers(headers -> headers
|
||||||
|
.frameOptions(frameOptions -> frameOptions.sameOrigin()))
|
||||||
.authorizeHttpRequests(auth -> auth.anyRequest().permitAll());
|
.authorizeHttpRequests(auth -> auth.anyRequest().permitAll());
|
||||||
return http.build();
|
return http.build();
|
||||||
}
|
}
|
||||||
|
|||||||
Reference in New Issue
Block a user